6fc287b2dc57fce3b1d7a95c8fdb6605e74d10e6644a800d67531965e2bdb7d8

Analysis

max time kernel
33s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
11-01-2023 18:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

login.html
Size

27KB
MD5

d7e398e2ff1a47b8889d7dc6c0818d22
SHA1

da98ab4b635e764fa13961987f840014eb546197
SHA256

6fc287b2dc57fce3b1d7a95c8fdb6605e74d10e6644a800d67531965e2bdb7d8
SHA512

f164b3a00de85e58f43390d52a71f7ed05d68b1c5647a2f42c33ad6e0fa4ed5d560e09f7668a268246ad6ab79c7bf6c58114aa9b92fecfd965c9d31eb18090f3
SSDEEP

384:mZ0e3ujIp/n7M0IQqC9RZfxSAZn0fZ91mP6GQmD3syZj5XCqzGX3o:C0GugIqjfxSAZnmZmDQysyZ9n

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af00000000020000000000106600000001000020000000d7a3b12e4e3c5dd19858b155af0bb92c970a4e583d1edccf48ca651ca2ef6b2e000000000e800000000200002000000019ba2491c07a5abb753e682416962a7d53e19a771056aa1793463c6890e98b219000000013af174bf03b3b879174f7abf756d6508585f93c4d69320f33c1df970318dd1c141ce3bc5313777a43504ac5ab1956b8c9b170083a041bd13a107fc1f5829093a82d49c8f961209816d0786e198e37abead056f8555d4ccb4975d74a55f8889a23c1e52ca669145f2e26edfda3defbfcfe06b0594befb973bd4cfc4b674e6397b758d569a4a7d95e72c2bee0593cab3c400000000cf407c2e7b212d73278e9dc8de4e9e65bdbb2ad4e7dc4e73e6c92892f049da4b76893a67c1fb5761513eccda505c0bd3484264eb5905b3a89d48c6282ff276c	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000fbec07815684004d899a318f710de6af000000000200000000001066000000010000200000008d1a938a52b4550736b23d0834112c8a953bea68d6101917e46bc46013870160000000000e80000000020000200000002c4d3cfeeb7b9b03f7df3ee6c97907aa29fda01a0643ba90580c02386647b8eb20000000e09e5c4e94d09fe798f037fdc6587ce6035984ffffeeea4373969f33da99c0a04000000097ecabcea97600f869cca8f2a1bfa0ed2a87b153f0de1cb6eb4295cd0cc67bd91ae95706eaae1a3daf19602fecba86be3eca7a3cb78e3c795aac105298eb2970	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{F1E13FD1-91E6-11ED-B06A-FE63F52BA449} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903f17c0f325d901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1476	iexplore.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1476	iexplore.exe
1476	iexplore.exe
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1716	IEXPLORE.EXE
1476	iexplore.exe
1476	iexplore.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 1716	1476	iexplore.exe	29
PID 1476 wrote to memory of 1716	1476	iexplore.exe	29
PID 1476 wrote to memory of 1716	1476	iexplore.exe	29
PID 1476 wrote to memory of 1716	1476	iexplore.exe	29

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1476 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1716

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
86c73059a0f5722b89c44115133aa13a

SHA1
5a9fff39111a5b9e71cadceb410b3db08deb2537

SHA256
9ad34da6f05dbbb3f5d7a5317cf6186440b64ecb2cbf502d78ad709ec054e42d

SHA512
081c2373f579c94d40cdb0724875d3a459d55a711ef9def400fd234ba3abebf4b482156940b1c6dd15fe3e9c8e04e8a3ddc2ca6e41c4fb2ab76162f23beb4083

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
194087bc47868c1e80d6cf7b509c7c77

SHA1
43cd3ef79c27e44bae05d15ad43063ef602c4691

SHA256
ca5fa211fa2a83016b2327ed114490428bff71736b23aee4dffd1c07bf0c99b7

SHA512
5f6620292521b2a8008d89382e54658411fea111e713a23d4188c8fb3e6f7b02ddc7de30e236ae5148df5d0c67a16a347d2e24002bceb4122343a358a74d2d3a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b15bde8cc606c18b88aedd163e7f249

SHA1
7dd3c8bce30bec674639b19b9495b58ea510fcbc

SHA256
0b16dc8dd3677ecc4a4dda6635f25b523a47d09389612c916a5f468f92dc2649

SHA512
06fb492858cca37515b0c392b7b653ea1831281073e9e6295f28322a5fc1baf42d5b69181f01e680cf25fa7105bec279625ccbb80759282340b54264865df97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
8KB

MD5
86a8314d147ac8277c272937b94f2629

SHA1
5fdba668015b5b924d30ddbe730cf4beb752bc6b

SHA256
ba0fcb5d8051a570832fb7be44738785bd146487172d905c8138b86cb38f850d

SHA512
7646bb465913fd1adfc6ab9faf2d980a58fb2df9275183849f45d00c02dcbb5e2ed4f31454f2fda7beec1ddfcd79732d5b313b011fdd6a100680ee272a834e58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\try74lz\imagestore.dat

Filesize
8KB

MD5
86a8314d147ac8277c272937b94f2629

SHA1
5fdba668015b5b924d30ddbe730cf4beb752bc6b

SHA256
ba0fcb5d8051a570832fb7be44738785bd146487172d905c8138b86cb38f850d

SHA512
7646bb465913fd1adfc6ab9faf2d980a58fb2df9275183849f45d00c02dcbb5e2ed4f31454f2fda7beec1ddfcd79732d5b313b011fdd6a100680ee272a834e58

Download Submit